DE102016119049B3 - Safety system with a safety switch - Google Patents

Abstract

Safety system (1) having a safety switch (2) for monitoring a safe protective device state of a movable safety device (3), having a base housing (4) consisting of at least two partial bodies (5, 6) which can be positioned relative to one another, wherein a signal receiver is provided in a part body (5) and a signal generator are provided in the other part body (6), so that a secure state of the protection device (3) can be detected by means of an evaluation unit (9), with a locking unit (10) with at least one locking element for locking or Unlocking the protective device (3), wherein at least one mobile identification transponder (12) is provided, at least one in the safety switch (2) arranged transponder reading unit (13), which is connected to the evaluation unit (9), wherein the evaluation unit (9) or an external central control unit is formed after verification and verification of the identification transponder the (12) received transponder signal, the locking unit (10) to unlock or lock.

Description

The present invention relates to a safety system with a safety switch according to the preamble of claim 1. Safety switch is a common and synonymous name for locking device or locking unit with tumbler according to the standard EN ISO 14119.

The industry uses machines that can be dangerous to humans. Examples of such machines are presses or robots that carry dangerous movements for humans. These areas are protected, for example, by mechanical fences or light grids. To be able to get into the area of the dangerous machine, however, movable guards, such as doors are provided, which are provided with safety switches. When the door is opened, the safety switch shuts down the machine.

Such safety switches continue to have a tumbler, so that the door is blocked and can not be opened. Only by a stop command on the door or on the central HMI of the machine, the tumbler can be disabled to gain access to the danger area, the dangerous movement is turned off. With trailing machines or processes, the door must be locked until the danger in the machine no longer exists.

The doors on machines serve as a protective device, namely as a movable safety guard in the sense of the Machinery Directive.

The monitoring and guard locking of the door is realized with safety switches with tumbler available on the market. It is for example a type 2 or a type 4 according to the standard ISO 14119 known. These switches are based on a mechanical principle, for. For example, the i10Lock safety switch from SICK or, for example, RFID technology such as the TRIO Lock safety switch from SICK.

If access to the machine is now to be enabled, a request to stop the machine is typically made with additional remote control buttons or via a man-machine interface.

The disadvantage of this technique is that with a decentralized possibility as well as with a non-access-controlled operating option via human-machine interface, the group of people who could make this request to stop the machine can not be limited.

The EP 2 871 402 A1 discloses a modular safety switch for monitoring a safety device state with a base housing, which consists of at least two partial bodies, which are formed positively to one another, wherein a signal generator in a partial body and a signal receiver are provided in the other partial body, so that a secure state of the protective device can be detected , and the partial bodies are formed such that a closing force is formed so that the partial bodies are held together when the partial bodies are arranged opposite to each other.

The US 2009/0040014 A1 discloses a detector configured to communicate with a sensor tag and a processor-based device configured to determine, based on a detected characteristic of a sensor tag, whether personal protective equipment is sufficient to work on a sensor To start work.

The object of the invention is to provide an improved safety system with a safety switch. Another object of the invention is to limit the circle of people who can make the request to stop the machine.

The object is achieved according to claim 1 by a safety system with a safety switch for monitoring a safe protective device state of a movable protective device, with a base housing consisting of at least two partial bodies, which are positioned to each other, wherein a signal receiver in a partial body and a signal generator in the other Partial bodies are provided so that a secure state of the protective device can be detected by means of an evaluation unit, with a locking unit with at least one locking element for locking or unlocking the protection device, wherein at least one mobile identification transponder is provided, at least one arranged in the safety switch transponder reading unit, which with the evaluation unit is connected, wherein the evaluation unit or an external central control unit is formed, after verification and verification of the received from the identification transponder Transponder signal to unlock or lock the locking unit.

According to the invention, the identification takes place decentralized in the field or on a system directly to the safe guard locking of the protective door or via the external central control unit. The machine operator can be equipped with different authorizations especially for larger machines without the need for operation via the central HMI the machine must take place or in each case a parallel identification system must be installed on the door.

The plant may, for example, be an industrial plant for the production of products. For example, this is part of a production plant for automobiles. The system can also be part of a machine or a system with several machines. The system has a safety area that must not be entered by persons when the system is active, as the person may be endangered by parts of the system. For example, the plant is one or more robots whose hazardous area of action lies within the safety area.

The safety system is a machine safety safety system, such as EN / ISO 13849-1 or EN / IEC 62061, which, for example, provides the functional safety framework for safety-related electrical control systems and their subsystems on machinery.

The identification transponder according to the invention can be designed very simply. For example, it is a handy device that can easily be carried or carried by a person. Optionally, the identification transponder on operating elements and / or at least one display element. Optionally, the safety switch or the transponder reading unit has operating elements and / or at least one display element.

Furthermore, the identification transponder has an evaluation unit. The evaluation unit is formed for example by a microcontroller. Furthermore, the identification transponder has a memory in order to store data on the identification transponder.

According to the invention, at least one reading station is arranged with a receptacle for the mobile identification transponder, wherein at least one spatially limited access area is arranged with the movable protective device for a system, wherein the mobile identification transponder is designed for reading data from at least one checking station within a safety area of the system, wherein the data comprises identification data for the review station and wherein the mobile identification transponder has an interface by means of which the data is wirelessly transferable from the review station to the mobile identification transponder, the review station being accessible only over the access area such that the access area is owned by a person the mobile identification transponder is passable before reaching the checking station and after leaving the checking station, the data of the mobi len identification transponder to the reading station and / or to a secure control are transferable.

The reading station is located outside the security area. The reading station receives the at least one identification transponder in a recording. The recording may be, for example, a tray or a slot. The reading station is designed to read out the identification transponder and to evaluate the data of the identification transponder in an evaluation unit. The reading station is also designed to influence the system directly or indirectly, ie to activate or deactivate the system.

The review station is located within the security area. The inspection station is stationary so that it can not be removed. The inspection station is integrated, for example, in the system.

The verification station contains at least data for identification, which can be retrieved via an interface wirelessly from the identification transponder. The interface is preferably a radio interface.

In a preferred embodiment of the invention, at least the communication between the transponder reading unit and the mobile identification transponder is safety-oriented, wherein a check is carried out, for example, by calculated checksums and / or by a redundant information transmission.

The transmission of the identification thus takes place via a secure communication with the control unit or a safety controller.

The authorization is assigned to the unique identification or ID of the identification transponder. Thus, a different authorization scope can be defined by the identification transponder and thus personal. This authorization scope can be defined and managed via the safety switch itself and / or via the control unit or a secure controller. For example, the scope of authorization can be defined and managed via a configuration interface.

For example, when managing permissions over secure control, secure communication is a communication that is Performance level according to EN ISO 13849 is sufficient or achieved.

For example, a safety protocol according to the IEC 61784 standard is used.

In a development of the invention, a stop command, a reset function, a start function, and / or a release of a security area can be executed by means of the mobile identification transponder.

For example, the evaluation unit is designed to transfer a request to stop the machine to a machine control.

According to the invention, a person can identify himself via the identification transponder or a personal chip by means of an identification. According to a rights profile of this personal identification transponder, the evaluation unit is designed, for example, to decide whether a person is entitled to request a stop of the machine or system and to open the door or protective door.

A reset function or restart / start function resets the machine or system or the safety system with the safety switch so that a direct start of the machine can take place. The start of the machine is initiated, for example, by pressing a start button of the operator. The reset function represents a restart interlock.

A release of the safety area can only be carried out if there are no persons in the danger area or in the safety area. This is determined, for example, by the fact that connected safety sensors no longer detect persons, or indicate a free protective field, or, for example, in that all persons have demonstrably left the danger area or safety area. A release of the security area is displayed, for example, by a key press or automatically detected.

In a preferred embodiment of the invention, the signal transmitter and the signal receiver are designed as an RFID system with RFID transponder and RFID reader.

An RFID transceiver unit, which is also referred to as an RFID reader, has an antenna arrangement for communicating with the device, which has, for example, an RFID transponder, wherein the RFID transponder has at least one coil for interacting with the antenna arrangement of the RFID Transmitter / receiver unit includes.

Radio Frequency Identification (RFID) transceivers are used in transceiver systems for automatically and non-contactly identifying and / or locating RFID transponders via magnetic coupling or radio waves. An RFID system typically includes first the RFID transponder (also referred to as a "tag" or "radio tag") that includes an antenna and is located on or in the device. As a rule, it comprises a characteristic identification data code which can be interrogated via the antenna arrangement by the RFID receiving unit or the RFID reader of the RFID system (also referred to as "transceiver"). For this purpose, the RFID transceiver unit comprises the antenna arrangement and a transceiver circuit (eg the EM405 chip from EM Microelectronics) for reading out this identifier from the RFID transponder. For reading out the identifier from the RFID transponder, the RFID transceiver unit typically generates alternating magnetic fields in order to transmit signals to the RFID transponder. The RFID transponder is designed, after receiving a corresponding signal from the RFID transceiver unit, to return data, in particular the signal comprising the identifier, in response to the RFID transceiver unit, which evaluates this signal with the evaluation unit and further processes it.

In RFID systems, the RFID transceiver unit generates alternating magnetic fields which are not only intended to transmit the data but can also serve to power the RFID transponder.

An RFID system thus has the advantage that the RFID transponder does not require its own power supply and can therefore be used flexibly. The RFID transponder derives its energy via the magnetic coupling, radio waves or radio waves from the RFID transceiver unit. The RFID transponder is addressed via the antenna arrangement of the RFID transceiver unit and responds to the RFID transceiver unit with information stored in the RFID transponder. The information transmitted by the transponder of the RFID system is received by the antenna arrangement and can then be evaluated in the evaluation unit. The stored information on the transponder contains at least one identifier, namely the identification data, which identifies the RFID transponder.

Since the RFID transponder is detected by radio waves, the system is very robust against environmental influences. Therefore, the RFID transceiver can be used with the RFID transponder in very harsh environments, such as in industrial environments where Lubricants are used and it can, for example, come to a high degree of contamination.

Since the detection of the RFID transponder via magnetic coupling or radio waves takes place, in contrast to an optical solution no line of sight between the first body part and the second body part is necessary. Therefore, the partial bodies can be completely encapsulated to protect them from harmful environmental influences.

In a development of the invention, the locking unit has magnetic and / or mechanical locking elements which bring about a retaining or closing force. A magnetic locking unit or magnetic locking elements are wear-free, since no mechanically moving parts are present. A mechanical locking unit or mechanical locking elements may, for example, be less expensive and more robust and may have higher locking holding forces.

In a preferred embodiment of the invention, the evaluation unit is designed with two channels. By a two-channel evaluation a redundant verification system is formed to detect errors that are detected, for example by a cross comparison. For this purpose, the evaluation unit has, for example, two microcontrollers which are connected to one another via an interface for data exchange. In addition to a redundant structure, the evaluation unit can also have a diverse structure, wherein, for example, two different microcontrollers are used.

In a preferred embodiment of the invention, the mobile identification transponder is a passive RFID transponder.

The structure of the basic housing of the safety switch has the advantage that the part of the body of the main body are completely variable attachable to the protective device, so that z. B. the safety switch can only be accessed from outside or inside the guard and this particular only with a fastener regardless of the mounting situation. By example, form-fitting design of the body part they can serve as stops both pendulum and sliding doors.

In a further development of the invention, the expansion modules form at least one hermetic cover, a closing unit for applying an additional retaining or closing force, an emergency stop button for safe shutdown, one or more status indicators, a door handle or a wired or wireless communication unit.

According to the invention, the identification transponder must always be carried by the person in order to reach the checking station. If the person would not carry the identification transponder, the system can not be reactivated. Only if the identification transponder can retrieve or read data at the checking station, a subsequent activation of the system, namely after leaving the security area and after re-reading the identification transponder in the reading station is possible. For this purpose, for example, a location identifier or a station identifier is transmitted to the identification transponder by the checking station or read by the identification transponder from the checking station.

The verification of the identification transponder at the inspection station can be carried out automatically. Ie. if the person has approached the verification station at a certain minimum distance, the data of the review station are automatically read by the identification transponder.

The person carrying the identification transponder must optionally carry out a check with the identification transponder itself at the checking station. For this purpose, it can be provided, for example, that the person must perform an action, for example an actuation of a button on the identification transponder. This ensures that the verification station is not automatically checked by the identification transponder, but always an active action of the person is necessary to check this.

The review station can also be very simple. In the simplest case, the checking station has a memory and an interface for providing data.

Optionally, several verification stations are provided. In particular in the case of large installations or large security areas or large installations with a plurality of security areas, a plurality of inspection stations are provided. It can be provided that the identification transponder must be checked at least at a verification station. However, it can also be provided that an identification transponder must be tested at several checking stations. Optionally, it can also be provided that an identification transponder must be checked at several check stations in a specific sequence.

The communication between the identification transponder and the verification station can take place unidirectionally or bidirectionally. In the simplest case, it is sufficient to simply read the data of the checking station. However, provision may also be made for data to be written to the checking station by the identification transponder.

The identification transponders can also be assigned to certain persons, so that a specific identification transponder can only be picked up or taken away by a specific person.

In a further development, a timer having a first time value is started when the mobile identification transponder is removed from the reading station in the mobile identification transponder.

This ensures that the person has left the security area within a prescribed period of time. If this time is not met, for example, a warning message can be made to search for the person concerned.

In a further development, upon reaching the checking station, the timer can be checked and if the first time value is undershot, a valid reaching of the checking station can be signaled and if the first time value is exceeded, a non-valid reaching of the checking station can be signaled.

In this case, the location identifier or the station identifier is linked to the first time value by the identification transponder.

If the time is exceeded, the system can not be started. The person is prompted to restart the routine. For this purpose, the person again removes the identification transponder from the reading station, again setting a first time value. The person must revisit the review station within a first time.

In a further development, upon reaching the checking station, a timer having a second time value is started by the mobile identification transponder in the mobile identification transponder.

This will further ensure that the person has left the security area within a prescribed time. If this second time value is not met, for example, a warning message can be made to search for the person concerned.

The invention will be explained below with regard to further advantages and features with reference to the accompanying drawings with reference to embodiments.

The figures of the drawing show in:

1 a safety system with a safety switch;

2 a safety system with a safety switch and a movable safety device.

In the following figures, identical parts are provided with identical reference numerals.

1 shows a security system 1 with a safety switch 2 for monitoring a safe guard condition of a movable guard 3 , with a basic housing 4 consisting of at least two partial bodies 5 and 6 exists, which are positioned to each other, wherein a signal receiver in a partial body 6 and a buzzer in the other body part 5 are provided, so that a safe state of the protective device 3 by means of an evaluation unit 9 is detectable, with a locking unit 10 with at least one locking element for locking or unlocking the protective device 3 , wherein at least one mobile identification transponder 12 is provided, at least one in the safety switch 2 arranged transponder reading unit 13 , which with the evaluation unit 9 is connected, wherein the evaluation unit 9 or an external central control unit is designed, after verification and verification of the identification of the transponder 12 received transponder signal, the locking unit 10 to unlock or lock.

According to 1 is the mobile identification transponder 12 an RFID transponder, in particular a passive RFID transponder.

At the plant 19 can it according to 2 For example, to act an industrial plant for the production of products. At the plant 19 It can also be a part of a machine or a system 19 to trade with several machines. The attachment 19 has a security area 21 not on people 25 may be entered when the plant 19 is active as the person 25 through parts of the plant 19 can be endangered. For example, in the plant 19 one or more robots 28 their hazardous area within the security area 21 lies.

The identification transponder 12 according to 2 can be very simple. For example, it is a handy device that is easy to use by the person 25 can be carried or carried. Optionally, the identification transponder 12 Operating elements and at least one display element.

Next has the identification transponder 12 For example, an evaluation 8th on. The evaluation unit 8th is formed for example by a microcontroller. Next has the identification transponder 12 a memory on to data on the identification transponder 12 save.

Next is the evaluation unit 9 trained the safety switch to submit a request to stop the machine to a machine control.

According to 2 can a person 25 via the identification transponder 12 or identify a personal chip by means of an identification. According to a rights profile of this personal identification transponder 12 is the evaluation unit 9 trained for example to decide if a person 25 is entitled to stop the machine or plant 19 to request as well as the door or protective device 3 to open.

The machine or system is activated via a reset function or start function 19 or the security system 1 with the safety switch 2 reset, leaving a direct start of the robot 28 can be done. The start of the robot 28 is initiated, for example, by pressing a start button of the operator. The reset function represents a restart interlock.

A release of the security area 21 can only be carried out when in the danger zone or in the security area 21 no persons 25 more are located. This is determined, for example, by the fact that connected safety sensors are not persons 25 Detect more, or indicate a free protective field, or for example by the fact that all persons demonstrably the danger area or security area 21 have left. A release of the security area 21 is displayed, for example, by a key press or automatically detected.

According to 2 is at least one reading station 17 with at least one shot 24 for the mobile identification transponder 12 arranged, wherein at least one spatially limited access area with the movable protective device 3 is arranged for the plant, wherein the mobile identification transponder 12 for reading data from at least one review station 20 within a security area 21 the system is formed, wherein the data identification data for the inspection station 20 and wherein the mobile identification transponder 12 has an interface, by means of which the data is transmitted wirelessly from the checking station 20 to the mobile identification transponder 12 are transferable, the review station 20 only over the access area 18 is accessible, so the access area 18 from a person 25 with the mobile identification transponder 12 before reaching the verification station 20 and after leaving the review station 20 passable, the data of the mobile identification transponder 12 to the reading station 17 and / or transferable to a secure control.

The review station 20 is within the security area 21 arranged. The review station 20 is stationary so that it can not be removed. The review station 20 is for example in the plant 19 integrated.

Identification data is provided on the transponder. The interface between the inspection station and the central controller or the security switch is typically wired. The transmission between the transponder and the checking station is possible for example by magnetic coupling, radio wave or radio wave.

The review station 20 can also be very simple. The review station 20 In the simplest case, it has a memory and an interface for providing data.

Optional are several verification stations 20 intended. Especially with large systems 19 or large security areas 21 or large plants 19 with a plurality of security areas 21 are several verification stations 20 intended. It can be provided that the identification transponder 12 at least at a review station 20 must be checked. However, it can also be provided that an identification transponder 12 at several review stations 20 must be checked. Optionally, it may also be provided that an identification transponder 12 at several review stations 20 must be checked in a specific order.

Optionally, it is provided that the identification transponder 12 only by authorized persons from the reading station 17 can be removed. For example, the authorized persons must 25 such as operators or service people using an electronic identity card or with the help of other means of identification at the reading station 17 sign up for an identification transponder 12 to obtain. When removing the identification transponder 12 for example, from the reading station 17 a start identifier to the identification transponder 12 Posted.

The identification transponders 12 can also be used by certain people 25 be assigned so that a particular identification transponder 12 only from a specific person 25 can be taken or taken.

LIST OF REFERENCE NUMBERS

1

security system

2

safety switch

3

movable safety device

4

Headers

5

partial body

6

partial body

8th

evaluation

9

evaluation

10

locking unit

12

mobile identification transponder

13

Transponder reader

17

reading station

18

access area

19

investment

20

Inspection station

21

security area

24

admission

25

person

28

robot

Claims (10)

Security system ( 1 ) with a safety switch ( 2 ) for monitoring a safe protective device state of a movable safety device ( 3 ), with a basic housing ( 4 ), which consists of at least two partial bodies ( 5 . 6 ), which are positionable with each other, wherein a signal receiver in a part body ( 5 ) and a signal generator ( 8th ) in the other part body ( 6 ) are provided so that a safe state of the protective device ( 3 ) by means of an evaluation unit ( 9 ) is detectable, with a locking unit ( 10 ) with at least one locking element for locking or unlocking the protective device ( 3 ), characterized in that at least one mobile identification transponder ( 12 ), at least one in the safety switch ( 2 ) arranged transponder reading unit ( 13 ), which communicate with the evaluation unit ( 9 ), the evaluation unit ( 9 ) or an external central control unit is designed, after verification and verification of the identification transponder ( 12 ) received transponder signal the locking unit ( 10 ) to unlock or lock, wherein at least one reading station ( 17 ) with a recording ( 24 ) for the mobile identification transponder ( 12 ), at least one spatially limited access area ( 18 ) with the movable safety device ( 3 ) for a plant ( 19 ), wherein the mobile identification transponder ( 12 ) for reading data from at least one review station ( 20 ) within a security area ( 21 ) the plant ( 19 ), the data identifying data for the review station ( 20 ) and wherein the mobile identification transponder ( 12 ) has an interface by means of which the data is transmitted wirelessly from the checking station ( 20 ) to the mobile identification transponder ( 12 ), the verification station ( 20 ) only via the access area ( 18 ), so that the access area ( 18 ) from a person ( 25 ) with the mobile identification transponder ( 12 ) before reaching the verification station ( 20 ) and after leaving the review station ( 20 ) is passable, wherein the data of the mobile identification transponder ( 12 ) to the reading station ( 17 ) and / or transferable to a secure control. Security system according to claim 1, characterized in that at least the communication between the transponder reading unit ( 13 ) and the mobile identification transponder ( 12 ) is safety-related. Security system according to at least one of the preceding claims, characterized in that by means of the mobile identification transponder ( 12 ) a stop command, a reset function, a restart function, and / or a release of a security area ( 21 ) is executable. Safety system according to at least one of the preceding claims, characterized in that the signal transmitter ( 8th ) and the signal receiver are designed as an RFID system with RFID transponder and RFID reader. Safety system according to at least one of the preceding claims, characterized in that the locking unit ( 10 ) have magnetic and / or mechanical locking elements, which cause a restraining or closing force. Security system according to at least one of the preceding claims, characterized in that the mobile identification transponder ( 12 ) is a passive RFID transponder. Safety system according to at least one of the preceding claims, characterized in that the partial bodies ( 5 . 6 ) at least one hermetic cover, a closing unit for applying an additional retaining or closing force, an emergency stop button for safe shutdown, form one or more status indicators, a door handle or a wired or wireless communication unit. Security system according to at least one of the preceding claims, characterized in that when removing the mobile identification transponder ( 12 ) from the reading station ( 17 ) in the mobile identification transponder ( 12 ) a timer having a first time value is started. Security system according to at least one of the preceding claims, characterized in that upon reaching the inspection station ( 20 ) the timer is verifiable and if the first time value is undershot, a valid reaching the review station ( 20 ) can be signaled and if the first time value is exceeded, a non-validation of the inspection station ( 20 ) can be signaled. Security system according to at least one of the preceding claims, characterized in that upon reaching the checking station ( 20 ) by the mobile identification transponder ( 12 ) in the mobile identification transponder ( 12 ) a timer with a second time value has been started.

Images